The vulnerability is caused by an improper neutralization of user input during web page generation, allowing malicious JavaScript to be stored and later executed in the browsers of any visitor who views the affected plugin content. The attacker can inject arbitrary scripts that run with the privileges of the visiting user.

All WordPress sites that use the Jennifer Moss MWW Disclaimer Buttons plugin version 3.41 or earlier are affected. The plugin stores disclaimer text in the database and displays it on the front end, providing the means for the stored payload to be served to site visitors.

The CVSS base score of 5.9 places this flaw in the medium severity range. The EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by submitting malicious content through the plugin’s text input interface, which is then stored and rendered to visitors, resulting in Cross‑Site Scripting execution.